The trick to Microsoft's article is, arguably, "completely compromised". How do we define “completely compromised”? In my experience, I have seen computers infected with hundreds of potential threats, identified by programs I have mentioned I used in previous blog entries and forum posts. In my case, these computer systems were federal, municipal, or city property, residing on such property. By rights, were the university to own these systems, the university would have every degree of flexibility in recalling their own property and doing with it what it pleases. This includes liquidating hard assets and reconfiguring soft ones. If the university has an acceptable use policy for their systems, and predetermines what rights they have to take the computer back into possession, even when files that do not belong to the university reside there, the issue becomes even clearer from a logical perspective.
The thinking about malware, in general, is that there is a very real risk that malware intrusion could signify imminent signs that a system has been “completely compromised”. Ports may be open, the software firewall may be compromised, and important information can be stolen or lost, simply through Internet connectivity. If I lend you my car, and somehow I discover that the car is being used by a different driver, or perhaps even infested by ants, I have every right to demand the car’s immediate and safe return. The difficulty comes with assessing whose property is “in the computer” after I retrieve it. This is why a potentially legally binding document explaining the property rights of the issuer of the system is so important. It would prevent the moral dilemma that comes with the notion of perceived risk and liability. Does the computer user know that if the computer becomes infected with malware, they will lose their files? Has the university made the computer user aware of this fact? Has the computer user acknowledged and agreed to be bound to these terms?
When it comes to actually fixing these computer systems, even then, that issue is variable. No answer is ever so simple, and as we know, it may take a skilled technician only a few minutes to reclaim a system from a few minor malware problems.
If your network is at real risk from your own computers, even if they are being loaned out, there are some real reasons to consider reformatting or reimaging these systems. One is the cost factor. It costs money for technicians to run around with bells and whistles on to fix computers that are enamored with malware from misuse. Basic principles of property rights tell us that if it is the university's property, and not the users, or even if the reverse is the case, the damage of that property could even further endanger other properties owned by the university.
Therefore, the university may have the right to protect their network by restricting access to systems they do not own. This danger could be posed to the entire network itself, and perhaps the servers. Therefore, logic tells us that it would be wise for you to formulate a plan for reimaging these systems quickly.
However, there is a variable degree of seriousness when it comes to the virus/malware threat, and some minor threats can be easily done away with using appropriate software. I believe that in these cases, you can argue that the system has not been "completely compromised". However, you are still taking a risk. This is why I have tried to emphasize preventative or proactive computer maintenance, do-it-yourself techniques, and other ways to protect the system before it is too late.
How organizations deal with these problems should be consistent with the issues at hand:
- The understanding of the informed user.
- The consent of the owner.
- The desire to see organizational resources properly allocated (will it take days to fix this problem, and is retaining that data worth days?)
- What monetary value do we place on the contents of a system even when it is unavailable, and should users be given time to get their files off of the systems?
I have found, that more times than not, malware is the effect, and not the cause of a problem. Most of the time, malware infections can be traced back to inadequate security procedures on the entire network, the individual computer, or misuse and misunderstanding by the computer user. As the term goes "Problem Between Desk and Chair" is a common issue in IT world. I believe leaving options open may be the best route. It is up to computer professionals to determine if a computer is “completely compromised” on a case by case basis. But that is also subject to budget constraints, and many other factors, that need to be considered by the university’s administrative body.
My experience tells me that, as much as possible, all systems should be uniform, able to carry the same restore image, and ready to be reformatted on a moment’s notice. The value of the work on the computer, if it can be preserved, should be, and the system should be returned to a working state. Whether or not the system has been completely compromised is dependent on a number of factors, which can be assessed by both analyzing and formulating threat assessments on certain viruses.
In many cases I have been able to save computers, without any side effects, and without any re-installation. In other cases, I had to rebuild systems that were torn asunder by the plague of malware which could not be assuaged. Subjectively, I prefer the reinstall option. But I also see value in saving the work of others and teaching others to protect, not just their own property, but the property of others.
You likely have found I have edited this several times due to the dilemna that the university does not actually own the systems, but does have the right to protect their own property.
ffice
